GCVE-110-OSM-2026-9998

The postinstall script is a Windows-targeting dropper that decodes a double-encoded (hex→base64) URL and downloads a file to `C:\Temp\rbx_<random>.z`, extracts it via PowerShell's `Expand-Archive`, then recursively scans the extracted directory for any `.exe` and executes it detached. The obfuscation with hex-escape strings for every sensitive identifier (`child_process`, `spawn`, `powershell`, `User-Agent`) is clearly evasive — legitimate roblox-ts type-definition packages have no reason to download and execute arbitrary Windows binaries at install time. The publisher account (`cleungon`, protonmail, < 1 day old) published under the `@rbx-ts` namespace to impersonate the well-known `roblox-ts` project, a textbook supply-chain squatting attack. The attacker model is: install-time Windows dropper with payload hosted on catbox.moe, targeting Roblox game developers who install the legitimate-looking package. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json OBFUSCATION - Decoded Hex Escape Content in scripts/postinstall.js (x5) - Hex Encoded Strings in scripts/postinstall.js: "'\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73'" - Unicode Escape Obfuscation in scripts/postinstall.js: "\x63\x68\x69\x6c\x64\x5f\x70\x72\x6f\x63\x65\x73\x73" - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES scripts/postinstall.js dropp.exe - sha256 hash - 5b1044b63801916cc026048cb35dcb69521796fc333d0836f501020dffea57c3